CVE-2016-0349 — Improper Access Control in IBM Business Process Manager

CWE-284 — Improper Access Control3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 71.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Business Process Manager
Timeline
PublishedJun 30
Latest updateMay 17

Description

IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDibm/business_process_manager8.5.6.0, 8.5.7.0+1

🔴Vulnerability Details

2
GHSA
GHSA-8r3q-2vjx-6w95: IBM Business Process Manager 8↗2022-05-17
▶
CVEList
CVE-2016-0349: IBM Business Process Manager 8↗2016-06-30
▶
CVE-2016-0349 — Improper Access Control in IBM | cvebase